[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fU2LMyMOPcziBBv3s6AvQvMe9MxHx50vL9VOQQSx5Tvw":3,"$fY3aEF9bQheHjqlE_WomilEv5JQQiVOn0ekEOc9QO7Vw":113},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":110,"created_at":111,"updated_at":112,"published_at":23},"attackers-exploit-sharepoint-authentication-bypass-cve-2026-55040-following-publ","Attackers Exploit SharePoint Authentication Bypass CVE-2026-55040 Following Public PoC Release","Threat actors are actively leveraging the critical flaw to bypass authentication controls on Microsoft SharePoint servers.","Microsoft SharePoint is under active attack as threat actors exploit CVE-2026-55040, a critical security feature bypass with a CVSS score of 9.1, immediately after public proof-of-concept code became available.",[10,11,12,13,14],"SharePoint","CVE-2026-55040","Authentication Bypass","Active Exploitation","Microsoft Security","# Attackers Exploit SharePoint Authentication Bypass CVE-2026-55040 Following Public PoC Release\n\n*Threat actors are actively leveraging the critical flaw to bypass authentication controls on Microsoft SharePoint servers.*\n\n**Tags:** `SharePoint` `CVE-2026-55040` `Authentication Bypass` `Active Exploitation` `Microsoft Security`\n\n> Microsoft SharePoint is under active attack as threat actors exploit CVE-2026-55040, a critical security feature bypass with a CVSS score of 9.1, immediately after public proof-of-concept code became available.\n\n---\n\n## Active exploitation begins after PoC release\n\nThreat actors have initiated active exploitation of CVE-2026-55040, a critical authentication bypass in Microsoft SharePoint Server, immediately following the public release of proof-of-concept code. The vulnerability, which carries a CVSS score of 9.1, was addressed by Microsoft during its July 2026 Patch Tuesday cycle but is now being leveraged in the wild to circumvent security controls and gain unauthorized access to sensitive data.\n\n## The flaw: Critical authentication bypass\n\nCVE-2026-55040 is a critical security feature bypass in Microsoft SharePoint Server, rooted in weak authentication mechanisms that allow attackers to circumvent standard access controls. The flaw carries a CVSS score of 9.1, reflecting both severe potential impact and high exploitability. This vulnerability was remediated by Microsoft during its July 2026 Patch Tuesday cycle.\n\n## Patching status and exposure window\n\nMicrosoft released the fix for CVE-2026-55040 during its July 2026 Patch Tuesday cycle, closing the authentication bypass in SharePoint Server. However, the rapid transition from public proof-of-concept release to active exploitation has created a critical exposure window for organizations that have not yet deployed these specific updates. Any environment still running unpatched versions of the server is currently vulnerable to unauthorized access and data compromise, making immediate remediation essential to mitigate ongoing threat activity.\n\n## Key points\n\n- CVE-2026-55040 is a critical security feature bypass in Microsoft SharePoint with a CVSS score of 9.1.\n- The vulnerability stems from weak authentication mechanisms that allow unauthorized access to the system.\n- Active exploitation has been observed in the wild following the public release of proof-of-concept code.\n- Microsoft patched this flaw as part of its July 2026 Patch Tuesday updates.\n- Organizations are urged to apply patches immediately and monitor for signs of unauthorized access.\n\n## Further reading & sources\n\n- [AmnesiaStealer Gives Attackers Live Control of Victims’ macOS Browsers](https:\u002F\u002Fsecurityaffairs.com\u002F197190\u002Fmalware\u002Famnesiastealer-gives-attackers-live-control-of-victims-macos-browsers.html) — Security Affairs\n- [SharePoint auth bypass exploited](https:\u002F\u002Fdefend.network\u002Fbriefings\u002Fsharepoint-authentication-bypass-chrome-vpn-malware-win-2026-08-14.html)\n- [Attackers Exploit SharePoint Authentication Bypass After Public PoC Release](https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fattackers-exploit-sharepoint.html)\n- [US Authorizes Private Cyber Firms to Hack Transnational Criminal Networks](https:\u002F\u002Fsecurityaffairs.com\u002F197161\u002Flaws-and-regulations\u002Fus-authorizes-private-cyber-firms-to-hack-transnational-criminal-networks.html)\n- [Adobe Commerce CVE-2026-71362 Comes Under Attack Shortly After Public Disclosure](https:\u002F\u002Fsecurityaffairs.com\u002F197149\u002Fhacking\u002Fadobe-commerce-cve-2026-71362-comes-under-attack-shortly-after-public-disclosure.html)\n- [U.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalog](https:\u002F\u002Fsecurityaffairs.com\u002F197110\u002Fhacking\u002Fu-s-cisa-adds-metabase-windows-and-cisco-secure-firewall-flaws-to-its-known-exploited-vulnerabilities-catalog.html)\n- [SharePoint CVE-2026-55040 Comes Under Attack Following Public Exploit](https:\u002F\u002Fsecurityaffairs.com\u002F197137\u002Fhacking\u002Fsharepoint-cve-2026-55040-comes-under-attack-following-public-exploit.html)\n- [Chess.com Leak Exposes 7.3 Million Users — Evidence Points to Scraping](https:\u002F\u002Fsecurityaffairs.com\u002F197174\u002Fbreaking-news\u002Fchess-com-leak-exposes-7-3-million-users-evidence-points-to-scraping.html)\n- [BianLian Ransomware: Shadow Data Extortion Group - Threat Actors](https:\u002F\u002Fdailysecurityreview.com\u002Fresources\u002Fthreat-actors-resources\u002Fbianlian-ransomware-shadow-data-extortion-group\u002F)\n- [Hackers leverage new Microsoft SharePoint exploit in attacks](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fmicrosoft\u002Fhackers-leverage-new-microsoft-sharepoint-exploit-in-attacks\u002F)\n- [Resecurity | From Web Request to Domain Compromise: Understanding the July 2026 SharePoint Attacks](https:\u002F\u002Fwww.resecurity.com\u002Fblog\u002Farticle\u002Ffrom-web-request-to-domain-compromise-understanding-the-july-2026-sharepoint-attacks)\n- [Zero Day Initiative — The July 2026 Security Update Review](https:\u002F\u002Fwww.thezdi.com\u002Fblog\u002F2026\u002F7\u002F14\u002Fthe-july-2026-security-update-review)\n- [SharePoint Server vulnerabilities: How to find impacted assets](https:\u002F\u002Fwww.runzero.com\u002Fblog\u002Fsharepoint)","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fattackers-exploit-sharepoint-authentication-bypass-cve-2026-55040-following-publ.png",{"actors":18,"malware":24,"targets":27,"timeline":32,"industries":72,"technologies":77},[19],{"url":20,"name":21,"slug":21,"type":22,"origin":23,"motivation":23},"\u002Fthreat-groups\u002Fbianlian","bianlian","ransomware",null,[25],{"name":26},"AmnesiaStealer",[28],{"name":29,"sector":30,"status":31,"geography":23},"Chess.com","Online gaming","confirmed",[33,36,40,44,47,50,52,55,58,61,65,69],{"date":34,"event":35,"description":23},"2023-11","leak",{"date":37,"event":38,"description":39},"2026-07-15","CISA Warning","CISA warned network defenders to secure SharePoint servers against CVE-2026-55040.",{"date":41,"event":42,"description":43},"2026-08-13","Article Publication \u002F Exploitation Report","Report published stating hackers began targeting the flaw shortly after public disclosure.",{"date":41,"event":45,"description":46},"Vulnerability Disclosure \u002F KEV Addition","U.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalog.",{"date":48,"event":49,"description":23},"2026-08-14","disclosure",{"date":48,"event":49,"description":51},"AmnesiaStealer disclosure by Pierluigi Paganini",{"date":48,"event":53,"description":54},"briefing_published","Daily briefing published summarizing active threats.",{"date":48,"event":56,"description":57},"Remediation Deadline","CISA orders federal agencies to fix the flaws by August 14, 2026, except for CVE-2026-68820.",{"date":59,"event":56,"description":60},"2026-08-25","Deadline for addressing CVE-2026-68820.",{"date":62,"event":63,"description":64},"August 12-13, 2026","Exploitation Spike","Eight exploitation attempts occurred after the public PoC release.",{"date":66,"event":67,"description":68},"January 2023","tactic_shift","Shifted primarily to exfiltration-based extortion.",{"date":70,"event":67,"description":71},"January 2024","Exclusively to exfiltration-based extortion.",[73],{"url":74,"name":75,"slug":76},"\u002Findustries\u002Fgaming-video-games","Gaming & Video Games","gaming-video-games",[78,81,84,87,89,92,95,97,99,101,103,104,106,108],{"vendor":79,"product":80},"Microsoft","SharePoint Server Subscription Edition",{"vendor":82,"product":83},"Apple","macOS",{"vendor":85,"product":86},"Google","Chrome",{"vendor":79,"product":88},"SharePoint Server",{"vendor":90,"product":91},"Adobe","Commerce",{"vendor":93,"product":94},"Cisco","Adaptive Security Appliance Software",{"vendor":79,"product":96},"Windows 10",{"vendor":93,"product":98},"Secure Firewall Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD)",{"vendor":79,"product":100},"Windows Ancillary Function Driver for WinSock (afd.sys)",{"vendor":102,"product":102},"Metabase",{"vendor":79,"product":10},{"vendor":79,"product":105},"Windows",{"vendor":79,"product":107},"Azure AD",{"vendor":79,"product":109},"SharePoint Enterprise Server 2016","exploitation","2026-08-18T18:47:03.864693+00:00","2026-08-18T18:47:10.167774+00:00",{"articles":114},[115,125,136,149],{"slug":116,"title":117,"summary":118,"tags":119,"hero_image_url":123,"story_type":110,"created_at":124},"attackers-exploit-macos-screen-sharing-authentication-bypass-cve-2026-65400-to-g","Attackers Exploit macOS Screen Sharing Authentication Bypass CVE-2026-65400 to Gain Root and Deploy Monero Miners","The flaw in macOS Screen Sharing allows network-based attackers to bypass authentication and obtain root access, with observed deployments of Monero crypto miners on compromised systems.",[83,120,121,12,122],"Screen Sharing","CVE-2026-65400","Monero Miner","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fattackers-exploit-macos-screen-sharing-authentication-bypass-cve-2026-65400-to-g.png","2026-08-18T14:41:55.953675+00:00",{"slug":126,"title":127,"summary":128,"tags":129,"hero_image_url":134,"story_type":110,"created_at":135},"active-attacks-target-max-severity-sap-commerce-cloud-rce-patched-three-days-ago","Active Attacks Target Max-Severity SAP Commerce Cloud RCE Patched Three Days Ago","A critical remote code execution vulnerability in SAP Commerce Cloud, patched on Tuesday, is already seeing exploitation attempts in the wild just three days later, according to Defused. The flaw, tracked as CVE-2026-58231, allows unauthenticated attackers to abuse a default authentication client and submit crafted input to trigger arbitrary code execution with high impact on confidentiality, integrity and availability.",[130,131,132,133],"SAP","Commerce Cloud","RCE","Retail","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Factive-attacks-target-max-severity-sap-commerce-cloud-rce-patched-three-days-ago.png","2026-08-14T15:55:48.267776+00:00",{"slug":137,"title":138,"summary":139,"tags":140,"hero_image_url":146,"story_type":147,"created_at":148},"new-ransomware-group-linkc-targets-h2o-ai-with-extortion-claims","New Ransomware Group Linkc Targets H2O.ai with Extortion Claims","A newly identified ransomware operation named Linkc has emerged, claiming to have breached AI and cloud provider H2O.ai and demanding payment in exchange for withheld sensitive corporate information.",[141,142,143,144,145],"Ransomware","H2O.ai","Data Exfiltration","Cybersecurity Threats","Extortion","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fnew-ransomware-group-linkc-targets-h2o-ai-with-extortion-claims.png","threat_actor_activity","2026-08-18T18:41:58.855449+00:00",{"slug":150,"title":151,"summary":152,"tags":153,"hero_image_url":158,"story_type":159,"created_at":160},"hunters-international-ceases-operations-announces-mass-leak-of-stolen-data-from-","Hunters International Ceases Operations, Announces Mass Leak of Stolen Data from 67 Victims","Hunters International has officially closed its project and announced it will leak stolen data from 67 victims, following a period of increased law enforcement pressure that led to its rebranding as World Leaks earlier this year.",[141,154,155,156,157],"Data Extortion","Hunters International","World Leaks","Cybercrime","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhunters-international-ceases-operations-announces-mass-leak-of-stolen-data-from-.png","ransomware_incident","2026-08-18T18:39:28.135907+00:00"]